Microsoft Dynamics NAV 5.

00
TM

Installation & System Management: Employee Portal for Microsoft Dynamics NAV

INSTALLATION AND SYSTEM MANAGEMENT: EMPLOYEE PORTAL FOR MICROSOFT DYNAMICS NAV

Information in this document, including URL and other Internet Web site references, is subject to change without notice. Unless otherwise noted, the companies, organizations, products, domain names, e-mail addresses, logos, people, places, and events depicted in examples herein are fictitious. No association with any real company, organization, product, domain name, e-mail address, logo, person, place, or event is intended or should be inferred. Complying with all applicable copyright laws is the responsibility of the user. Without limiting the rights under copyright, no part of this document may be reproduced, stored in or introduced into a retrieval system, or transmitted in any form or by any means (electronic, mechanical, photocopying, recording, or otherwise), or for any purpose, without the express written permission of Microsoft Corporation. Microsoft may have patents, patent applications, trademarks, copyrights, or other intellectual property rights covering subject matter in this document. Except as expressly provided in any written license agreement from Microsoft, the furnishing of this document does not give you any license to these patents, trademarks, copyrights, or other intellectual property. 2007 Microsoft Corporation. All rights reserved. Microsoft, MS-DOS, Windows, Windows Server, Windows Vista, Application Server for Microsoft Dynamics NAV, AssistButton, C/AL, C/FRONT, C/SIDE, FlowField, FlowFilter, C/SIDE Database Server for Microsoft Dynamics NAV, Microsoft Business SolutionsNavision, Microsoft Dynamics NAV, Microsoft Dynamics NAV Debugger, Navision, NAV ODBC, SIFT, SIFTWARE, SQL Server, SumIndex, SumIndexField are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries. All other trademarks are property of their respective owners.

PREFACE

This book is a manual for Microsoft Dynamics NAV. It is part of a comprehensive set of documentation and Help materials for Microsoft Dynamics NAV. The manual describes how to install and maintain the Employee Portal for Microsoft Dynamics NAV. However, we recommend that the installation and customization process is carried out with the assistance of a Microsoft Certified Business Solutions Partner representative. You should be familiar with the symbols and typographical conventions used in the Microsoft Dynamics NAV manuals. In the list below, you can see how various elements of the program are distinguished by special typefaces and symbols:
Appearance CTRL Address Element Keys on the keyboard. They are written in small capitals. Field names. They appear in medium bold and start with a capital letter. Names of windows, tables, boxes and tabs. They appear in medium bold italics and start with a capital letter. Text that you must enter, for example: "...enter Yes in this field." It is written in italics. File names. They are written with the Courier font and lowercase letters. The special symbols that can be seen in the windows on the screen.

Department

Hansen

fin.flf

pohbk

TABLE OF CONTENTS

PART 1

INSTALLING EMPLOYEE PORTAL FOR MICROSOFT DYNAMICS NAV . . . . . . . . . 1

Chapter 1 Installing Employee Portal . . . . . . . . . . . . . . . . . . . . . . . . . . 3 Introduction to Employee Portal for Dynamics NAV . . . . . . . . . . . . . . . . . . . . . 4 System Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 Installing the Dynamics NAV Employee Portal Back-End Components . . . . . 6 Installing Dynamics NAV Employee Portal Front End Components . . . . . . . 10 Service Packs and Security Updates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 Setting Up Employee Portal. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 Viewing the Employee Portal Demo Site . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 Appendix A Miscellaneous . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .23

Reports in Employee Portal . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 Encrypting Data in Employee Portal. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 Setting Up Employee Portal to Encrypt Data . . . . . . . . . . . . . . . . . . . . . . . . . . 29 Running Multiple Dynamics NAV Application Servers . . . . . . . . . . . . . . . . . . 33

Table of Contents

Part 1 Installing Employee Portal for Microsoft Dynamics NAV

Chapter 1 Installing Employee Portal

This chapter introduces you to Employee Portal features and describes its software requirements. Furthermore, you can read, among other things, how to install Employee Portal components, set up Employee Portal and view the demo site. The chapter contains the following sections: Introduction to Employee Portal for Dynamics NAV System Requirements Installing the Dynamics NAV Employee Portal Back-End Components Installing Dynamics NAV Employee Portal Front End Components Setting Up Employee Portal Viewing the Employee Portal Demo Site

Chapter 1. Installing Employee Portal

1.1 Introduction to Employee Portal for Dynamics NAV

The Employee Portal for Dynamics NAV makes it easy for your employees to work with critical business information on your company intranet. Employees use SharePoint Services the Microsoft intranet standard to access real-time business information directly from Microsoft Dynamics NAV. With Employee Portal, your employees use a Web-based interface to: Get quick updates of real-time business information such as invoices, customer data and reports Modify information that is immediately updated directly in your business system Employee Portal is intuitive and requires a minimum of programming. It comes with out-of-the-box Microsoft .NET based Web Parts, and it is easy to configure on the Microsoft Dynamics NAV back end. To read more about Employee Portal functionality, see the Employee Portal online Help.

1.2 System Requirements

1.2 System Requirements

Employee Portal requires that you install the non-localized versions of the software products listed below on a Windows platform with the latest service packs. We recommend that you do these things in the following order: Server Requirements 1 Install Microsoft Windows Server 2003 2 Install Microsoft Internet Information Server (included with Windows Server 2003) 3 Install Microsoft ASP.NET 1.1 (included with Windows Server 2003) 4 Install Microsoft Message Queueing Services (included with Windows Server 2003) 5 Install Microsoft SharePoint Services 6 Install Microsoft Visual J# .NET 1.1 Framework Redistributable Package
Note

For information about how to install and configure the products listed above, see Microsofts documentation.
Service Packs and Security Updates Before your deployment is complete, be sure to apply the latest service packs and relevant security updates to your system. Keeping current on the latest service packs, in particular, is one of most important things you can do in managing the security of your system. You should not consider a deployment complete until your system is updated. For more information about service packs and security updates, see: Microsoft Windows Update Microsoft Security home page Web Client Any browser that can be used with Microsoft SharePoint can be used with Employee Portal.

Chapter 1. Installing Employee Portal

1.3 Installing the Dynamics NAV Employee Portal Back-End Components

Employee Portal is an integrated part of Dynamics NAV and as such the back-end components can be installed as a part of the Dynamics NAV installation. This chapter describes the additional steps you must take when you include Employee Portal in your installation of Dynamics NAV. You must install the following Dynamics NAV products for the back end: Dynamics NAV Database Server or SQL Option Dynamics NAV C/SIDE Client NAV Application Server

Installing Dynamics NAV Database Server or SQL Option No additional steps need to be taken when installing Dynamics NAV Database Server or SQL Option 4.0 SP1 for Employee Portal. To read more about how to install these products, refer to Microsofts documentation.

Installing the Dynamics NAV Client To include Employee Portal in a Dynamics NAV client installation, you must include Employee Portal in the list of features that will be installed with the client. The list of features will be displayed when you select to run a custom installation. In the Custom Setup window, you must select the Employee Portal feature:

The installation program will now install the following five .dll files on the client:
Microsoft.Navision.EmployeePortal.Security.dll Microsoft.Navision.EmployeePortal.PictureDisplay.dll Microsoft.Navision.EmployeePortal.NavisionUtility.dll Microsoft.Navision.EmployeePortal.ErrorUtility.dll Microsoft.Navision.EmployeePortal.Hash.dll

1.3 Installing the Dynamics NAV Employee Portal Back-End Components

Refer to the Installation & System Management manual for the server option you are running for information about how to install a Dynamics NAV C/SIDE client.

Installing the NAV Application Server When you install the Application Server for Microsoft Dynamics NAV make sure to select Custom Setup. Include Employee Portal in the list of features that will be installed with the application server:

Employee Portal uses message queues for the communication process. It is important that all request queues are installed on the computer hosting NAV Application Server and that the reply queues are installed on the server hosting SharePoint. It is not possible to do remote reading on the queues.
The installation program creates the private queue Request Queue. Messages sent by the front end are stored in this queue until Dynamics NAV picks them up for processing. The installation program also installs the following five .dll files on the computer that hosts the application server:
Microsoft.Navision.EmployeePortal.Security.dll Microsoft.Navision.EmployeePortal.PictureDisplay.dll Microsoft.Navision.EmployeePortal.NavisionUtility.dll Microsoft.Navision.EmployeePortal.ErrorUtility.dll Microsoft.Navision.EmployeePortal.Hash.dll

Do not start the application server yet. Refer to the manual Installation & System Management: Application Server for Microsoft Dynamics NAV for information about how to install NAV Application Server.

Setting Up a User Profile for a NAV Application Server For each NAV Application Server that you install, you must set up a user profile. The names of NAV Application Servers are generated during installation.

Chapter 1. Installing Employee Portal

To create a local user: 1 On the Start menu, click Control Panel, Administrative Tools, Computer Management. 2 Under System Tools, expand Local Users and Groups. Right-click Users and select New User. You can now create a new local user. Name it, for example, NEP_user. Then you can set up a user profile for your application server. In the following procedure, we use the name "NAV Application Server ServerName", where "ServerName" represents the name that was used when the server was installed. To set up a user profile for a NAV Application Server: 1 On the Start menu, select Programs, Administrative Tools, Services. 2 In the Services window, Right-click Microsoft Dynamics NAV Application Server ServerName and click Stop. If the Stop menu item is gray, then the service is not running. 3 Right-click Microsoft Dynamics NAV Application Server ServerName again and click Properties. 4 Click the Log On tab.

5 Select the This account field. 6 In the This account field, enter the user name. Enter the user's password in the Password and Confirm password fields. Click OK. Do not start NAV Application Server yet.

1.3 Installing the Dynamics NAV Employee Portal Back-End Components

Additional Software to Install After you have installed the back-end components, you must install the software products listed below on the appropriate servers:
Product Description

Microsoft .NET Install this product on the server that is running the Application Server for Microsoft Dynamics NAV Framework (included with Windows Server 2003) Microsoft Visual J# .NET Framework Redistributable Package Install this product on the server that is running the Application Server for Microsoft Dynamics NAV.

Microsoft Message Install this product on the server you want to handle the Queueing Services message queue communication. (included with Windows Server 2003)

Chapter 1. Installing Employee Portal

1.4 Installing Dynamics NAV Employee Portal Front End Components

Finally, you must install Employee Portal Front End Components for the front end. A description of the installation follows.

What are the Employee Portal Front End Components? To install the Employee Portal front end components, locate the Employee Portal installation program on the Microsoft Dynamics NAV Product DVD. The installation program will guide you through the installation process. 1 In the Customer Information window, you enter a user name and an organization name.

2 In the Server Name window, enter the name of the computer that hosts the back end message queue which Employee Portal communicates with.

10

1.4 Installing Dynamics NAV Employee Portal Front End Components

3 In the Setup Type window, you can choose between two setup types, Complete or Custom:

Select Complete to install both Employee Portal Front End Components and the demo site on your computer. Select Custom to choose which components are installed and where:

11

Chapter 1. Installing Employee Portal

4 If you have selected Custom Installation the Ready to install the Program window will open. Click Install to start the installation:

5 The Install Shield Wizards installs the front end components. The Employee Portal Front End installation has performed the following tasks: Created a private queue for the messages received by the front end from Dynamics NAV Application Server. Copied a Web Part pack containing the Web Parts developed for Employee Portal together with the resources it needs to the front end. Copied the five .dll files to the front end:
Microsoft.Navision.EmployeePortal.Communication.dll Microsoft.Navision.EmployeePortal.Connector.dll Microsoft.Navision.EmployeePortal.DataStorage.dll Microsoft.Navision.EmployeePortal.ErrorLibrary.dll Microsoft.Navision.EmployeePortal.UserControlLibrary.dll

Created a new virtual directory. Installed the KeyExchangeManagement service. Installed the Dynamics NAV Key Exchange Management console. Configured the Web.config file to match you computer name and queue names.

12

1.5 Service Packs and Security Updates

1.5 Service Packs and Security Updates

The installation is not complete until you have installed the latest service packs and applied the latest security updates to your system. Keeping your system up-to-date by installing the latest service packs is one of most important things you can do in managing the security of your system. You should visit Microsoft Update and install all the relevant updates on every computer in your Dynamics NAV installation. We also recommend that you enable Automatic Updates on each computer so that they can receive security & critical updates automatically.

13

Chapter 1. Installing Employee Portal

1.6 Setting Up Employee Portal

After installing the required software and the Dynamics NAV front end components, there are a few additional steps you must take before you can start using your Employee Portal.

Setting Up a Demo Site If you are installing Employee Portal for demonstrational purposes using the demonstration company CRONUS, data has already been set up for a fully functional Employee Portal. Therefore, you can skip the steps described in the sections listed below: Captions Defining Captions for Employee Portal Setup Setting Up Groups Setting Up Web Part Requests

NAV Application Server NAV Application Server is used to handle the communication between Dynamics NAV and SharePoint. You must create an application server record in Dynamics NAV for each application server that you set up. On the card you must specify both encryption and request setup before the communication can begin. Click Administration, Application Setup, Employee Portal, Application Server Setup. The EP Appln. Server Setup Card window appears:

Use the fields in the EP Appln. Server Setup Card window as follows:
Field Code Description Enter the code of the application server. The code must be equal to the start up parameter for the application server. The code must start with NEP-. Enter a description of what the application server does.

Description

14

1.6 Setting Up Employee Portal

Field Use Encryption

Description Place a check mark in this field to activate encryption of the data sent from Dynamics NAV to the front end. The corresponding values must be set in the front end in the Web.config file. See the section Setting Up Employee Portal to Encrypt Data in the Appendix. Place a check mark in this field to activate compression of the data sent from Dynamics NAV to the front end. The corresponding values must be set in the front end in the Web.config file. Set the UseCompression value to 1: <add key=UseCompression"value ="1"/> Place a check mark in this field to make this application server handle the communication between Dynamics NAV and the front end. Enter the path of the message queue handling the messages coming into Dynamics NAV. For example, .\private$\nep_request_queue. Enter the path of the message queue handling the messages going out of Dynamics NAV. For example, .\private$\nep_reply_queue. Place a check mark to make this application server handle the trust requests from the front end. Enter the path of the message queue handling the messages coming into Dynamics NAV from trusted sites. Enter the path of the message queue handling the messages going out of Dynamics NAV to trusted sites.

Use Compression

Front End Processing

Request Queue

Reply Queue Handle Key Exchange Key Exchange Request Queue Key Exchange Reply Queue

Captions In Employee Portal you must define captions for text you need on your Web Parts for navigational or informational purposes that is not stored as application data. It is important that you define at least one caption for each of the elements listed below. It is also important that you attach captions to all instances of the these elements that you create. Otherwise the Web client will receive an error. You must now define the following captions: Group Captions Web Part Request Captions Web Part Table Tab Captions Web Part Table Action Captions Web Setup Captions Creating a Caption The following task is an example of how to define a caption. The procedure of defining a caption is the same for all captions. All caption lists can be found under Administration, Application Setup, Employee Portal, Captions. 1 Open the caption list of the relevant type of caption. For example, the EP WP Table Tab Caption List.

15

Chapter 1. Installing Employee Portal

2 Click Caption, Create New. The EP Language List appears. 3 Select the language you want to make a caption for. Click OK. 4 In the caption line you just created, enter your new caption in the Caption field. 5 Close the window. You could, for example, set up a caption for the tabs for sales order in the EP WP Table Tab Caption List window, as follows:

Use the fields in the EP WP Action Caption List window as follows:

Field User ID Language ID Caption Description Insert the user ID defined for the user in SharePoint. Insert the ID of the language you want to define a caption for. Enter the caption you want to be shown to the user.

If you are designing Web Parts that will be used in different languages by different users, you must give the caption a definition in each language.

Defining Captions for Employee Portal Setup When you add a Web Part to your portal page, you need to configure the Web Part by defining which data the Web Part will request from Dynamics NAV. You do this in the custom property fields in the SharePoint tool pane. The custom properties are the properties that have been created to introduce Employee Portal functionality to the Web Part. The custom property fields are the applying fields. The custom property fields are specific for Dynamics NAV and the captions for these fields need to be defined on the Employee Portal Setup Card in Dynamics NAV. You will find the Employee Portal Setup Card under Administration, Application Setup, Employee Portal, Setup. The Employee Portal Setup Card window contains two tabs, the Configuration Tool Pane tab and the Search Tool Pane tab. On the Configuration Tool Pane tab, you specify the captions of the configuration of Card, List and Header + Line Web Parts. On the Search Tool Pane tab you specify the captions of the configuration of Search Web Parts.

16

1.6 Setting Up Employee Portal

Use the fields in the EP Setup Card window as follows:

Field Config Tool Pane Caption Description Enter the caption you want to show in the tool pane as the heading of the Employee Portal custom property area for Card, List and Header + Line Web Parts. You can, for example, enter Employee Portal Tool Pane. Enter the caption you want to show as the heading of the field in which you can select the Web Part Request you want the Web Part to use. You can, for example, enter Web Part Request. Enter the caption you want to show as the heading of the field in which you can select if you want the Web Part to perform an initial request. You can, for example, enter No Initial Request. Enter the caption you want to show as the heading of the field in which you can select the group of request. You can, for example, enter Group. Enter the caption you want to show in the tool pane as the heading of the Employee Portal custom property area for Search Web Parts. You can, for example, enter Employee Portal Search Tool Pane. Enter the caption you want to show as the heading of the field in which you can select the table that the search will run through. You can, for example, enter Table. Enter the caption you want to show in the field in which you select the table as an option to search through all tables. You can, for example, enter All Tables. Enter the maximum numbers of records you want the program to list on each tab in a search result.

Config TP WP Request Caption

Config TP Initial Req. Caption

Config TP Group Caption

Search Tool Pane Caption

Search Config Table Caption Search TP All Tables Caption Search Limit

You could, for example, set up the captions for Configuration Tool Pane in the Employee Portal Setup Card window, as follows:

17

Chapter 1. Installing Employee Portal

This will show in the SharePoint Tool Pane on your portal page as follows:

You could, for example, set up the captions for Search Tool Pane in the Employee Portal Setup Card window, as follows:

18

1.6 Setting Up Employee Portal

This will show in the SharePoint Tool Pane on your portal page as follows:

Setting Up Groups A group is a collection of Web Part Requests. Web Part Requests are based on Dynamics NAV informational and/or functionality that helps the user perform a task. You can combine the Web Part Requests in a group in any way that meets your needs. You can choose to set up a few general groups, each containing all the permissions for one user type or you can set up a group for each task or part of a task that users will perform. Then you can customize each user's rights and possibilities. After you have created a group, you can assign users to the group to give them access to the Web Part Requests that are assigned to that user group. In Employee Portal, the EP Group Card window, you could, for example, set up a group as follows:

19

Chapter 1. Installing Employee Portal

Use the fields in the EP Group Card window as follows:

Field Code Description No. of WP Requests Language ID Description Insert a code to identify the group. Enter a description of the group. Contains the number of Web Part Requests connected to the group. The field is updated automatically. Insert the ID of the language you want to be used for this group. If you do not enter an ID in this field and you also leave Language ID field in the EP Users table empty, the Web Parts will be shown in the default language of your NAV Application Server. Enter the caption to show the group as an option in the field in the SharePoint tool pane in which you select the group you want to add a request from.

Caption

After you have defined your groups, you can add Web Parts requests to the groups. You can read more about this the in Employee Portal online Help.

Setting Up Users Users must be assigned to a group to get access to the Web Part Requests that are assigned to that group. You can define in what language the data will be presented to the user on your portal page. All other settings are inherited from the group. Use the fields in the EP User List window as follows:
Field User ID Description Insert the user ID defined for the user in SharePoint. The format of the user ID must be DOMAIN/USERID. Make sure that both the domain and the user ID is identical to the ones defined in the SharePoint configuration. Insert the ID of the language you want to be used for this user. If you leave this field empty, the Web Parts will be shown in the language defined for the group.

Language ID

Setting Up Web Part Requests Refer to the Dynamics NAV Employee Portal online Help for information about setting up Web Part request templates and Web Part request. The online Help also describes all the steps you must complete in Dynamics NAV to set up your Employee Portal.

20

1.6 Setting Up Employee Portal

Back End Key-Pair Finally, you need to create a back end key-pair. You do that on the Employee Portal Setup Card.

1 On the Employee Portal Setup Card, click Security, Create Back End Key-Pair.

Application Server Set up a user for your Application Server. Make sure that the user ID and domain is identical to the one you defined for the Application Server in the section Setting Up a User Profile for a NAV Application Server. You can now start the application server.

21

Chapter 1. Installing Employee Portal

1.7 Viewing the Employee Portal Demo Site

Start a Web browser and browse to the Employee Portal demo site, http://localhost/default.aspx. You should be able to click Modify Shared Page, Add Web Parts, Browse, Virtual Server Gallery to view the Employee Portal Web Parts that are available in the demo data. If you are also able to add a Web Part to your portal page and select a Web Part Request, it means that the two-way communication is up and running. To read more about SharePoint functionality, see Microsofts documentation of this product. To read more about how to work with Dynamics NAV Employee Portal, see Employee Portal online Help.

22

Appendix A Miscellaneous
This appendix provides additional information about Employee Portal for Microsoft Dynamics NAV. The appendix contains the following sections: Reports in Employee Portal Encrypting Data in Employee Portal Setting Up Employee Portal to Encrypt Data Running Multiple Dynamics NAV Application Servers

A.1 Reports in Employee Portal

In Employee Portal you can run any Dynamics NAV report from your Web part. As a part of the demo data, five reports have been fully defined and are ready to be added to your Web parts. Also as a part of the demo data four tables have been declared in the codeunit, but if you want to add new reports that relate to one of these four tables, you must add some additional code to code unit 6828 EP Report Mgt. Finally, if you want to add a report that does not relate to any of the four predeclared tables, you need to declare a new function for that table in code unit 6828 EP Report Mgt. as well. The following five reports are ready to be added to your Web parts: 204 Sales - Quote 205 Order Confirmation 99000753 Quantity Explosion of BOM 99000754 Rolled-up Cost Shares 99000756 Detailed Calculation For further information about how to define a report as an action in your Web part, refer to the Employee Portal online Help. The following four tables have already been declared in code unit 6828 EP Report Mgt.: 18 Customer Table 27 Item Table 36 Sales Header Table 23 Vendor Table When you define an action for your report, you can also define the filters for your report. You define your filters in the EP WP Action Filter Field List.

Adding Reports Related to the Predefined Tables If you want to add additional reports that relate to one of the four tables used in the demo data, you must add a condition to the CASE construction of the

24

A.1 Reports in Employee Portal

CreateReportPreview procedure in codeunit 6828 EP Report Mgt. You could, for example, add the Customer - Order Summary report:

Adding Reports Not Related to the Predefined Tables If you want to add a report that relate to another table than the ones listed above, you must declare a new function as well. You can do this by using one of the existing functions as a template. You could, for example, add the Purchase Header table:

25

A.2 Encrypting Data in Employee Portal

It lies in the nature of the design of Employee Portal that it has to communicate over the network to access and forward data. This communication can be tracked on various points on the network between the SharePoint server and the NAS. To improve the security of the communication you can set up Employee Portal to encrypt the data sent. Employee Portal uses cryptographic methods. Cryptography helps you discover if your data has been viewed or modified by others than those you communicate with. It also helps increase the security of the communication over otherwise insecure channels. For example, data can be encrypted using a cryptographic algorithm, transmitted in an encrypted state and later decrypted by the intended recipient. If a third party intercepts the encrypted data, it will be difficult to decipher. Employee Portal uses a combination of the available cryptographic methods to achieve the following goals: Confidentiality: Protect the transmitted data from being read. Data integrity: Protect data from being altered and identify the attempt. Authentication: Ensure that data originates from a particular portal. In order to achieve all of the goals Dynamics NAV Employee Portal is using a combination of symmetric (Secret key), asymmetric (Public key) cryptography and cryptographic signing. The following table lists the cryptographic primitives and their uses:
Cryptographic Primitive Description

Secret-key encryption Performs a transformation on data, keeping the data from (symmetric cryptography) being read by third parties. This type of encryption uses a single shared, secret key to encrypt and decrypt data. Public-key encryption (asymmetric cryptography) Cryptographic signing Performs a transformation on data, keeping the data from being read by third parties. This type of encryption uses a public/private key pair to encrypt and decrypt data. Helps verify that data originates from a specific party by creating a digital signature that is unique to that party. This process also uses hash functions.

Symmetric / Asymmetric Encryption The process of symmetric encryption is very fast (compared to the asymmetric pendants). The disadvantage of this process is that both sides must know the key which is used for the encryption. To gain the performance boost of the symmetric methods but also to be as secure as possible, the key is sent within the message but the key itself is protected by an asymmetric encryption method. In Dynamics NAV Employee Portal each message is secured by using an one-timegenerated key for the symmetric encryption and the public key of the recipient to encrypt this symmetric key. Only the recipient can decrypt the symmetric key by using the private key. Therefore the public key always has to be sent to the other communication partner.

26

A.2 Encrypting Data in Employee Portal

Signing Data To be sure that the message has not been altered between the two communication partners, Employee Portal uses signatures in the messages. This generates a small piece of information which can be used to: identify the sender identify if the message itself has been changed The signing process is using the private key of the sender. Afterwards, the generated signature can be checked by the receiver by using the public key of the sender.

Communication Process The general communication process is shown in the following figure:

There are in general two different ways that the user can access the Employee Portal: from the Internet from the Intranet (LAN) As you can see in the figure there are three different communication sectors: Between the client (browser) and the SharePoint Server Between the SharePoint Server and NAV Application Server Between the NAV Application Server and Dynamics NAV To increase the security of the environment you will must use encrypted communication between each point of the whole process. Between Client and SharePoint Server The security of the communication between the browser (client) and the SharePoint server can be increased by using the HTTPS protocol. Therefore, there has to be installed a server certificate on the SharePoint server. After this certificate is installed, you can set the Internet Information Server, which is hosting the SharePoint site, to use only HTTPS secured communication for each browser connection. Between SharePoint Server and NAV Application Server The next step of the communication process is sending the messages between the SharePoint Server and the NAV Application Server. The security of this communication can be improved by using the built-in functionality of public/private keys (which is similar to using two certificates on each communication partner). In the setup form of Employee Portal Setup card in Dynamics NAV, you can create a public/private key pair. This pair is stored in the Dynamics NAV database and is used

27

for decrypting and signing data which is sent from the Dynamics NAV system to the SharePoint server. The Windows service is responsible for creating a public/private key pair on the SharePoint server and sending the public key part to Dynamics NAV. After the initialization phase, the SharePoint server can use this pair for decrypting and signing data which is sent to Dynamics NAV. The public key of Dynamics NAV is also stored on the SharePoint server because it is used to encrypt the data which is sent to Dynamics NAV. On the other side, the SharePoint public key is stored in Dynamics NAV to encrypt data which is sent to the SharePoint server. Between NAV Application Server and Dynamics NAV Read more about Dynamics NAV security best practices in the Dynamics NAV Security Hardening Guide.

28

A.3 Setting Up Employee Portal to Encrypt Data

A.3 Setting Up Employee Portal to Encrypt Data

This section describes the steps you have to take the first time you want to establish an encrypted communication between Dynamics NAV and the front end. You need to set up both Dynamics NAV and the front end to encrypt the data sent. This includes: 1 Create a back end key-pair for Dynamics NAV 2 Create message queues 3 Set up an application server to handle key exchange 4 Send a request from your site to be acknowledged by Dynamics NAV 5 Acknowledge site request 6 Activate encryption of messages handled by the application server

Message Queues Set up the message queues to handle the key exchange. Set up a request queue and a reply queue:

Give the user account you have defined for your application server access to the queues.

29

EP Appln. Server Setup Card To set up an application server to handle key exchange, fill in the fields in the Key Exchange tab fields in the EP Appln. Server Setup Card window as follows:
Field Handle Key Exchange Key Exchange Request Queue Description Place a check mark to make this application server handle the trust requests from the front end. Enter the path of the message queue handling the messages coming into Dynamics NAV from trusted sites.

Key Exchange Reply Queue Enter the path of the message queue handling the messages going out of Dynamics NAV to trusted sites.

Enter the name of the queues you have just created in the Key Exchange Request Queue and Key Exchange Reply Queue fields.

Restart the application server. The application server has successfully been set up to handle key exchange if the event log contains the following text: Dynamics NAV Employee Portal Trust Appl. Server has been started.

Request from Site The exchange of keys must be initiated by the site. You must send a request from the site to Dynamics NAV to be acknowledged as a trusted site. This is done by using the Key Exchange Management console. The Key Exchange Management console is installed together with the Dynamics NAV front end components. It gives you an interface to activate the KeyExchange Management service.

30

A.3 Setting Up Employee Portal to Encrypt Data

Start Dynamics NAV Key Exchange Management:

Use the fields in the key exchange management console as follows:

Field Description URL Path to Web.config Request Queue Reply Queue Status Description Enter a description of the key exchange request. Enter the address of the Web site. Enter the path to the Web.config file. Enter the path to the request queue defined for handling key exchange. Enter the path to the reply queue defined for handling key exchange. Shows the status of the request.

Acknowledge Request from Site When a request for being acknowledged by Dynamics NAV as a trusted site is sent from a site, the request will be received by Dynamics NAV and placed in the EP Trusted Site table. You can then acknowledge or delete the request from the EP Trusted Site List.

To acknowledge the request: 1 Click Security, Acknowledge Request. The request is acknowledged.

31

2 A reply is sent to the trusted site and connection for communication of encrypted messages is established.

Activate Encryption of Messages You activate encryption of messages handled by the application server in two steps. First, you must now go back to the EP Appln. Server Setup Card and place a check mark in the Use Encryption field on the General tab. Secondly, you must open the Web.config file and set the UseEncryption value to 1:
<add key="UseEncryption" value="1" />

32

A.4 Running Multiple Dynamics NAV Application Servers

A.4 Running Multiple Dynamics NAV Application Servers

To enhance the scalability it is possible to run more than one Dynamics NAV Application Server to serve one or more SharePoint Portal servers. Installing NAV Application Servers First, you must install the number of NAV Application Servers you need. You can install the application servers on one or several computers. For installation and setup information when running more than one application server, see the manual Installation & System Management: Application Server for Microsoft Dynamics NAV. Defining Message Queues You can set up different queues for each application server, but you may also use the same job and reply queues. Create the number of job queues that meets your needs on the computer where your application servers are installed. Create the number of reply queues that meets your needs on the computer where your SharePoint Server is installed.
Note

To increase the security of the message queue transmission you can use HTTPS for your message queue communication. For more information about increasing the security of your Dynamics NAV installation, refer to the Dynamics NAV Security Hardening Guide. Set up an EP Appln. Server Card for each NAV Application Server in Dynamics NAV. Fill in the fields according to what you want the application server to handle. Make sure that the settings in the Use Compression and the Use Encryption fields are identical on all EP Appln. Server Cards. Also, make sure that the parameter in Start-Up Parameter field defined for the application server in the NASMSSnapIn corresponds to the parameter defined in the Code field in the EP Appln. Server Card. For information about how to fill in the EP Appln. Server Card, refer to the section NAV Application Server in this manual or the Employee Portal online Help. Configuring the SharePoint Server Finally, you must configure the SharePoint server to be aware of the queues you have created. You do that by adding the queues to the Web.config file found in the root folder of your SharePoint site.

33

If for example, you only use one request queue named NEPJob1 and one reply queue named NEPReply1, the QueueManagement in Web.Config must look like this:
<add key="QueueManagement" value=""> <!-- specify message queue connection strings --> <Queues> <Queue qid="1" connstr="FormatName:DIRECT=TCP:192.168.1.3\private$\NEPJob1" /> <Queue qid="2" connstr=".\private$\NEPReply1" /> </Queues> <!-- specify default job and reply queue (priority 1) --> <DefaultQueues> <JobQueue qid="1" /> <ReplyQueue qid="2" /> </DefaultQueues> </add>

If for example, you use three request queues named NEPJob1, NEPJob2 and NEPJob3 and two reply queues named NEPReply1 and NEPReply2, the QueueManagement in Web.Config must look like this:
<add key="QueueManagement" value=""> <!-- specify message queue connection strings --> <Queues> <Queue qid="1" connstr="FormatName:DIRECT=TCP:192.168.1.3\private$\NEPJob1" /> <Queue qid="2" connstr="FormatName:DIRECT=TCP:192.168.1.3\private$\NEPJob2"/> <Queue qid="3" connstr="FormatName:DIRECT=TCP:192.168.1.3\private$\NEPJob3" /> <Queue qid="4" connstr=".\private$\NEPReply1" /> <Queue qid="5" connstr=".\private$\NEPReply2" /> </Queues> <!-- specify default job and reply queue (priority 1) --> <!--DefaultQueues> <JobQueue qid="1" /> <ReplyQueue qid="4" /> </DefaultQueues--> <!-- specify queue mapping and queue order (priority 2) --> <QueueMapping> <Queue mappingid="1" jobid="1" replyid="4" /> <Queue mappingid="2" jobid="2" replyid="5" /> <Queue mappingid="3" jobid="3" replyid="4" /> </QueueMapping> </add>

The queues have been added with a unique "qid" and a mapping between the queues has been defined.

34

SYMBOLS
A Acknowledge Request . . . . . . . . . . . . . . . . 31 application server setup . . . . . . . . . . . . . . . 14 B back end key-pair . . . . . . . . . . . . . . . . . . . . 21 C captions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 captions, setting up . . . . . . . . . . . . . . . . . . . 15 client . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 communication process . . . . . . . . . . . . . . . 27 cryptographic primitive . . . . . . . . . . . . . . . 26 D demo database predefined Web part requests . . . . . . . 22 demo site . . . . . . . . . . . . . . . . . . . . 11, 22, 23 Dynamics NAV Application Server service setting up a user profile . . . . . . . . . . . . . . 7 E encrypting data . . . . . . . . . . . . . . . . . . . . . . 26 F front end components . . . . . . . . . . . . . . . . 10 G groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 K key exchange management . . . . . . . . . . . 30 Key-Pair . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 R reports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 S security security updates . . . . . . . . . . . . . . . . . . . 13 Service Packs . . . . . . . . . . . . . . . . . . . . . . . . 13 U user profile Dynamics NAV Application Server service 7 W Web client . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 Web.config . . . . . . . . . . . . . . . . . . . . . . . . . . 12

Index